From: Ronan Pigott <ronan@rjp.ie>
Date: Sat, 18 Feb 2023 20:03:07 +0000 (-0700)
Subject: systemctl: edit: fix double free of instanced name
X-Git-Tag: v254-rc1~1236
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fe5cb7a7aec49cdc77d02e109dde81293e4566a0;p=thirdparty%2Fsystemd.git

systemctl: edit: fix double free of instanced name

There is a double free of unit_name when an instance is used, causing
systemctl --user edit service@instance to abort.
---

diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
index e200e312dbb..df016679200 100644
--- a/src/systemctl/systemctl-edit.c
+++ b/src/systemctl/systemctl-edit.c
@@ -457,7 +457,7 @@ static int find_paths_to_edit(
                 return r;
 
         STRV_FOREACH(name, names) {
-                _cleanup_free_ char *path = NULL, *tmp_name = NULL;
+                _cleanup_free_ char *path = NULL;
                 _cleanup_strv_free_ char **unit_paths = NULL;
 
                 r = unit_find_paths(bus, *name, &lp, false, &cached_name_map, &cached_id_map, &path, &unit_paths);
@@ -501,7 +501,7 @@ static int find_paths_to_edit(
                         /* We follow unit aliases, but we need to propagate the instance */
                         if (unit_name_is_valid(*name, UNIT_NAME_INSTANCE) &&
                             unit_name_is_valid(unit_name, UNIT_NAME_TEMPLATE)) {
-                                _cleanup_free_ char *instance = NULL;
+                                _cleanup_free_ char *instance = NULL, *tmp_name = NULL;
 
                                 r = unit_name_to_instance(*name, &instance);
                                 if (r < 0)
@@ -511,7 +511,7 @@ static int find_paths_to_edit(
                                 if (r < 0)
                                         return r;
 
-                                unit_name = tmp_name;
+                                free_and_replace(unit_name, tmp_name);
                         }
 
                         if (arg_full)